RECORDS MANAGEMENTRECORDS MANAGEMENTELECTRONIC RECORDSELECTRONIC RECORDSE-DISCOVERYE-DISCOVERY

2007 Massachusetts Digital 2007 Massachusetts Digital SummitSummitAlan N. Cote, Esq.Alan N. Cote, Esq.First Deputy Secretary of the CommonwealthFirst Deputy Secretary of the CommonwealthSupervisor of RecordsSupervisor of RecordsOffice of the Secretary of the CommonwealthOffice of the Secretary of the Commonwealth 617-727-2832 617-727-2832 Alan.Cote@sec.state.ma.usAlan.Cote@sec.state.ma.us

AGENDAAGENDA

Records Management OverviewRecords Management Overview Records Custodian (New Records Custodian (New

Responsibilities)Responsibilities) Retention Schedules (07/07) Retention Schedules (07/07) Emails, Electronic Records – ESIEmails, Electronic Records – ESI E-DiscoveryE-Discovery Questions and AnswersQuestions and Answers

EVOLVING EVOLVING RECORDS MANAGEMEMENT RECORDS MANAGEMEMENT

RESPONSIBILITIESRESPONSIBILITIES

Alan CoteAlan Cote

Supervisor of Public RecordsSupervisor of Public Records

SECRETARY OF STATESECRETARY OF STATE

RECORDS MANAGEMENT RECORDS MANAGEMENT Secretary of State PolicySecretary of State Policy

Proper management of records ensures that Proper management of records ensures that the government has immediate access to the government has immediate access to information for the full period of time it is information for the full period of time it is needed to conduct daily business, financial needed to conduct daily business, financial transactions, litigation, maintenance of public transactions, litigation, maintenance of public property, and development and property, and development and implementation of public policy. implementation of public policy.

Access to information also secures the public's Access to information also secures the public's prerogative to monitor the government and prerogative to monitor the government and encourage its accountability to the governed.encourage its accountability to the governed.

Definition of Record?Definition of Record?

““all books, papers, maps, photographs, all books, papers, maps, photographs, recorded tapes, financial statements, recorded tapes, financial statements, statistical tabulations, or other statistical tabulations, or other documentary materials or data, documentary materials or data, regardless of physical form or regardless of physical form or characteristics, characteristics, made or receivedmade or received by by any officer or employee” of any any officer or employee” of any Massachusetts governmental entity.Massachusetts governmental entity.

How About Electronic How About Electronic Records?Records?

The Public Records Law applies to all The Public Records Law applies to all government records generated, government records generated, received or maintained electronically, received or maintained electronically, including computer records, electronic including computer records, electronic mail, video and audiotapes.mail, video and audiotapes.

STATEWIDE RECORD STATEWIDE RECORD RETENTION SCHEDULE RETENTION SCHEDULE “07/07”“07/07” See See www.sec.state.ma.us/arc/arcrmu/rmurds/0707.docwww.sec.state.ma.us/arc/arcrmu/rmurds/0707.doc

Some Departments have specialized retention Some Departments have specialized retention schedulesschedules

Departments must retain records in an Departments must retain records in an accessible formataccessible format (capable of being reproduced (capable of being reproduced or printed) for the period designated in the or printed) for the period designated in the retention scheduleretention schedule

Departments may not destroy records without Departments may not destroy records without the approval of the Records Conservation the approval of the Records Conservation BoardBoard

RECORDS STORAGERECORDS STORAGE

Departments must ensure that records are Departments must ensure that records are stored in SECURE environment that is not stored in SECURE environment that is not subject to the risk of theft or destructionsubject to the risk of theft or destruction– Do not store on floors in basements or other Do not store on floors in basements or other

areas that could flood or suffer water damageareas that could flood or suffer water damage– Electronic records must be stored and backed Electronic records must be stored and backed

up to ensure up to ensure datadata not overwritten or destroyed not overwritten or destroyed due to environment (warped DVDs stored in due to environment (warped DVDs stored in attic or storage areas that are not temperature attic or storage areas that are not temperature controlled).controlled).

RECORDS STORAGERECORDS STORAGE

For records >3 yrs retention, For records >3 yrs retention, Departments may store at State Departments may store at State Records CenterRecords Center

Permanent Records may be stored at Permanent Records may be stored at the Archives upon approval of State the Archives upon approval of State ArchivistArchivist

Departments should not use 3Departments should not use 3rdrd party party storage centers without SEC approvalstorage centers without SEC approval

How long must a record be How long must a record be kept?kept?

How long a record must be retained is How long a record must be retained is determined by the Statewide Records determined by the Statewide Records Retention Schedule Retention Schedule – Junk mailJunk mail – dispose of after use – dispose of after use– ContractsContracts, grants, ISAs – 6 yrs after last , grants, ISAs – 6 yrs after last

paymentpayment Retention requirements apply to all Retention requirements apply to all

formats (paper and electronic)formats (paper and electronic)

EMAIL RETENTION EMAIL RETENTION

Emails made or received are “records” Emails made or received are “records” All email users must screen and evaluate All email users must screen and evaluate

email messages for “email messages for “CONTENTCONTENT”.”. Statewide Disposition Schedule Statewide Disposition Schedule

determines how long to preserve recorddetermines how long to preserve record– Junk email or SPAM – dispose of after useJunk email or SPAM – dispose of after use– Email scheduling Meeting – dispose of after Email scheduling Meeting – dispose of after

useuse– Contract related correspondence – retain for Contract related correspondence – retain for

6 yrs after final payment6 yrs after final payment

EMAIL RETENTIONEMAIL RETENTION

All government offices must establish All government offices must establish written policieswritten policies for email systems for email systems capable of displaying and preserving capable of displaying and preserving the contextual data (metadata)the contextual data (metadata)

Government offices must ensure that Government offices must ensure that all personnel who will be handling all personnel who will be handling email are email are properly trainedproperly trained to ensure to ensure compliance with this policy.compliance with this policy.

Department Records Department Records CustodianCustodian

EVERY Department is required to have EVERY Department is required to have a Records Custodiana Records Custodian

Custodians must provide proper care Custodians must provide proper care and management of public records and management of public records (see: G. L. c. 66, s. 1 et seq.). (see: G. L. c. 66, s. 1 et seq.).

A custodian is defined as a "...A custodian is defined as a "...person person having routine access to or control of having routine access to or control of public recordspublic records." (see: 950 CMR 32.03) ." (see: 950 CMR 32.03)

New Responsibilities for New Responsibilities for Records CustodiansRecords Custodians

New stringent “New stringent “E-DiscoveryE-Discovery” rules ” rules require state departments to produce all require state departments to produce all paper and electronic records within paper and electronic records within state records retention periodstate records retention period

If a department is involved directly or If a department is involved directly or indirectly in litigation, the department indirectly in litigation, the department may be subject to a “may be subject to a “litigation holdlitigation hold” ” and will be required to preserve and and will be required to preserve and provide access to all records in their provide access to all records in their controlcontrol

RECORDS MUST BE RECORDS MUST BE RETAINED UNDER RETAINED UNDER LITIGATION HOLDLITIGATION HOLD

““Litigation holdLitigation hold” may require retrieval of ” may require retrieval of emails and other electronic records during emails and other electronic records during retention periodretention period

Can not destroy emails (or other records) Can not destroy emails (or other records) once “once “litigation holdlitigation hold” in place” in place

Records Custodian must ensure that no Records Custodian must ensure that no records or emails are destroyed, even if records or emails are destroyed, even if retention period is passedretention period is passed

– If department failed to destroy records once If department failed to destroy records once retention period passed, if a litigation hold is retention period passed, if a litigation hold is made, these records must be preserved and made, these records must be preserved and must be provided if requestedmust be provided if requested

New Responsibilities for New Responsibilities for Records CustodiansRecords Custodians

““Litigation holdsLitigation holds” requires high level ” requires high level coordination between Legal, IT and coordination between Legal, IT and Program staffProgram staff

Records Custodian no longer a Records Custodian no longer a ministerial duty of filing paper in boxes ministerial duty of filing paper in boxes and storing and storing

Records Custodian Records Custodian ResponsibilitiesResponsibilities

Records Custodian must Records Custodian must KNOWKNOW::– WhatWhat records the Department makes or records the Department makes or

receivesreceives– WhoWho makes or receives the records makes or receives the records– WhenWhen the records can/should be destroyed the records can/should be destroyed

according to the Records Retention Scheduleaccording to the Records Retention Schedule– WhatWhat format the records are made or received format the records are made or received– WhereWhere the records are stored the records are stored– HowHow the records can be accessed during the the records can be accessed during the

retention periodretention period

New Responsibilities for New Responsibilities for Records CustodiansRecords Custodians

Records Custodian must have Records Custodian must have authority to direct personnel who authority to direct personnel who control or hold recordscontrol or hold records

Records Custodian should now be Records Custodian should now be General Counsel, CFO or higher General Counsel, CFO or higher ranking officer who can manage the ranking officer who can manage the increased responsibilities related to increased responsibilities related to Records ManagementRecords Management

OVERVIEW OF E- OVERVIEW OF E- DISCOVERYDISCOVERY

Under state and federal rules, all Under state and federal rules, all department records (public and non-public department records (public and non-public records) may be subject to disclosure as records) may be subject to disclosure as part of a lawsuitpart of a lawsuit

Departments are required to provide Departments are required to provide access to all records, whether in paper or access to all records, whether in paper or electronic form (electronic stored electronic form (electronic stored information – “ESI”), or face stiff penalties.information – “ESI”), or face stiff penalties.

Examples of ESI ContentExamples of ESI Content

System outputSystem output System data (when users log on, System data (when users log on,

websites visited, passwords used, docs websites visited, passwords used, docs printed or faxed) printed or faxed)

Office documents (ex: Word, Office documents (ex: Word, Powerpoint, Excel)Powerpoint, Excel)

PhotosPhotos MapsMaps MoviesMovies

Examples of ESI Media and Examples of ESI Media and Storage DevicesStorage Devices

Emails and their attachmentsEmails and their attachments Web pages, old and newWeb pages, old and new VideosVideos Floppy disksFloppy disks CDsCDs AudiotapeAudiotape VideotapeVideotape

ESI Special Data ESI Special Data ConsiderationsConsiderations

Deleted data is not necessarily deletedDeleted data is not necessarily deleted Embedded data (draft language, editorial Embedded data (draft language, editorial

comments, e.g. Track Changes data)comments, e.g. Track Changes data) Metadata (data about the history, Metadata (data about the history,

tracking or management of an electronic tracking or management of an electronic file, e.g. email wrapper)file, e.g. email wrapper)

End user search tools that create store of End user search tools that create store of docs accessed (Google Desktop search) docs accessed (Google Desktop search)

ESI: Not Reasonably Accessible but Must ESI: Not Reasonably Accessible but Must be Produced Nonethelessbe Produced Nonetheless

If the court orders ESI that is not If the court orders ESI that is not reasonably accessible to be produced, reasonably accessible to be produced, agencies may have to rely on: agencies may have to rely on: – ITD to provide backup tapes for ITC-hosted ITD to provide backup tapes for ITC-hosted

applications or MassMailapplications or MassMail– Other systems administrators for backup Other systems administrators for backup

tapestapes– Local LAN team to help sort through local Local LAN team to help sort through local

MassMail archiveMassMail archive– Computer forensics consultants Computer forensics consultants

ESI: Who Knows Where it is ESI: Who Knows Where it is Stored?Stored?

Records CustodianRecords Custodian The agency employees, contractors or agents whose The agency employees, contractors or agents whose

documents are subject to discoverydocuments are subject to discovery– Agencies have certain contractual rights under the Agencies have certain contractual rights under the

Commonwealth’s T’s and C’s to the documents created Commonwealth’s T’s and C’s to the documents created by vendors in fulfilling their contractual obligationsby vendors in fulfilling their contractual obligations

Your CIO or Systems Administrator Your CIO or Systems Administrator Business owners of the dataBusiness owners of the data None of the above alone; e-records and e-devices are None of the above alone; e-records and e-devices are

not 100% centrally controlled or managed in any not 100% centrally controlled or managed in any organizationorganization

ESI: Who knows where it is ESI: Who knows where it is stored?stored?

Do not limit your inquiry to CIO; he Do not limit your inquiry to CIO; he or she may not necessarily knowor she may not necessarily know: : – Whether employees are using HotMail or Whether employees are using HotMail or

home email addresses to conduct state home email addresses to conduct state businessbusiness

– Whether they have copied emails to .pst Whether they have copied emails to .pst files before deleting themfiles before deleting them

– Whether they download Commonwealth Whether they download Commonwealth documents to their home PC, handheld or documents to their home PC, handheld or other personal device other personal device

– Answers to questions about systems Answers to questions about systems administered at the enterprise leveladministered at the enterprise level

ESI: ConclusionESI: Conclusion

Move from paper to electronic discovery has Move from paper to electronic discovery has decentralized discoverable material and the decentralized discoverable material and the persons who control it. Control over access persons who control it. Control over access and knowledge often in hands of user instead and knowledge often in hands of user instead of central agency authorityof central agency authority

Start by developing an ESI map taking into Start by developing an ESI map taking into account people, data, devices, and locations.account people, data, devices, and locations.

Do not under any circumstances rely on your Do not under any circumstances rely on your CIO and ITD alone to determine what CIO and ITD alone to determine what discoverable ESI your agency’s employees discoverable ESI your agency’s employees and contractors may control and contractors may control

Preparing for E-DiscoveryPreparing for E-Discovery Assemble the teamAssemble the team

– Secretary or agency headSecretary or agency head– CFO – funding issues related to complianceCFO – funding issues related to compliance– CIO – manager of IT and electronic systems CIO – manager of IT and electronic systems – Key IT people (who will be Agency’s Fed. R. Civ. P. 30(b)(6) Key IT people (who will be Agency’s Fed. R. Civ. P. 30(b)(6)

witness?)witness?)– Records Managers/CustodianRecords Managers/Custodian– Legal CounselLegal Counsel

Inventory recordsInventory records– Identify hardware/software that contains records (version, how Identify hardware/software that contains records (version, how

stored)stored)– Perform an application inventory (e.g. HRCMS, office applications)Perform an application inventory (e.g. HRCMS, office applications)– Storage formats for backup dataStorage formats for backup data

Where are they located?Where are they located? How segregated (by record, individual, dept.)?How segregated (by record, individual, dept.)? Frequency of tape recycle?Frequency of tape recycle?

– Consider off-site records (e.g. vendors, home computers) Consider off-site records (e.g. vendors, home computers) – Document resultsDocument results

Preparing for E-DiscoveryPreparing for E-Discovery

Beyond compliance, think offensivelyBeyond compliance, think offensively– What documents may become relevant and What documents may become relevant and

useful (e.g. contract correspondence, useful (e.g. contract correspondence, service/call logs)service/call logs)

How will you modify or suspend deletion How will you modify or suspend deletion when necessary?when necessary?– How long does it take to stop recycling How long does it take to stop recycling

backup tapes, and who should be notified?backup tapes, and who should be notified?– How quickly can you capture the records of How quickly can you capture the records of

key players (what IT resources do you need)?key players (what IT resources do you need)?

Preparing for E-DiscoveryPreparing for E-Discovery

– How quickly can you take a snapshot of How quickly can you take a snapshot of email or other information?email or other information?

Consider: Consider: – 44thth Amendment implications Amendment implications– State and Federal wire tap statutesState and Federal wire tap statutes– Does agency have a recently signed copy of Does agency have a recently signed copy of

an Acceptable Use Policy for every IT user?an Acceptable Use Policy for every IT user?

– Develop a means to notify appropriate Develop a means to notify appropriate personnel when a claim is raised (agency personnel when a claim is raised (agency counsel, IT personnel)counsel, IT personnel)

Implementation of Records Implementation of Records ManagementManagement

Train staffTrain staff– Alert staff to obligations (RIC and other relevant Alert staff to obligations (RIC and other relevant

record retention obligations)record retention obligations)– If possible combine document retention training If possible combine document retention training

with business writing training with business writing training Employees should not say in email anything they Employees should not say in email anything they

would not want produced as public recordwould not want produced as public record

– Educate employees on general discovery duties in Educate employees on general discovery duties in litigationlitigation

– Identify records custodian for each unitIdentify records custodian for each unit

Implementation (continued)Implementation (continued)

Compliance reviewCompliance review– Have team in place (IT, legal, senior management)Have team in place (IT, legal, senior management)– Test un-recycled backup tapes to ensure they are Test un-recycled backup tapes to ensure they are

recoverablerecoverable– Consider requiring managers to certify that the Consider requiring managers to certify that the

policy is being followedpolicy is being followed– Annual review clean up days Annual review clean up days

Pizza, prizes etc., casual clothingPizza, prizes etc., casual clothing Reminders to review home computers, PDAsReminders to review home computers, PDAs

– Document complianceDocument compliance– Document retention compliance discussion Document retention compliance discussion

becomes part of exit interviewbecomes part of exit interview

BIGGEST RISKBIGGEST RISKLack of Enterprise Wide Records Management Lack of Enterprise Wide Records Management

PracticePractice

Executives, managers and staff are not Executives, managers and staff are not properly trained on implication of the properly trained on implication of the records they createrecords they create

Don’t realize that these records may Don’t realize that these records may need to be retained or are need to be retained or are discoverable in litigationdiscoverable in litigation

BIGGEST RISKBIGGEST RISKLack of Enterprise Wide Records Management Lack of Enterprise Wide Records Management

PracticePractice

Many don’t know that emails can be used as Many don’t know that emails can be used as evidenceevidence

Staff or systems may routinely delete emails Staff or systems may routinely delete emails or other records when space becomes limitedor other records when space becomes limited

IT staff are not trained in records IT staff are not trained in records management requirements and may management requirements and may inadvertently delete records to free up spaceinadvertently delete records to free up space

IGNORANCE IS NO LONGER ACCEPTABLEIGNORANCE IS NO LONGER ACCEPTABLE

““Ignorance of IT is simply no longer an Ignorance of IT is simply no longer an acceptable cover for mistakes in most federal acceptable cover for mistakes in most federal courts.” courts.” www.www.ralphloseyralphlosey..wordpresswordpress.com/.com/zubuzubu-duty/-duty/

Courts reject attorney excuses of “computer Courts reject attorney excuses of “computer illiteracy” as “frankly ludicrous”.illiteracy” as “frankly ludicrous”. Martin v. Northwester mutual Martin v. Northwester mutual

Life Insurance CompanyLife Insurance Company, 2006 WL 148991 (M.D. Fla. Jan 19, 2006)., 2006 WL 148991 (M.D. Fla. Jan 19, 2006).

““Attorneys can no longer blame their Attorneys can no longer blame their knowledge gap on lack of guidance from the knowledge gap on lack of guidance from the courts… E-discovery conduct has been courts… E-discovery conduct has been sanctioned in all 12 federal jurisdictions.” sanctioned in all 12 federal jurisdictions.” www.www.abanetabanet.org/.org/lpmlpm//lptlpt/articles/tch02052.html/articles/tch02052.html

Most Common E-DiscoveryMost Common E-Discovery Abuses or Errors Abuses or Errors

Failing to place holds on destruction routines Failing to place holds on destruction routines when litigation expectedwhen litigation expected

Failing to notify court of e-discover problemsFailing to notify court of e-discover problems Failing to provide accurate recordsFailing to provide accurate records Failing to fully respond to discovery requests Failing to fully respond to discovery requests

with all requested recordswith all requested records ““Purposeful sluggishness” in respondingPurposeful sluggishness” in responding Fabricated evidenceFabricated evidence

www.www.abanetabanet.org/.org/lpmlpm//lptlpt/articles/tch02052.html/articles/tch02052.html

Some ResourcesSome Resources

http://www.http://www.thesedonaconferencethesedonaconference.org/content/.org/content/miscFilesmiscFiles/publications_html/publications_html

http://www.law.com/http://www.law.com/jspjsp//legaltechnologylegaltechnology//eDiscoveryRoadmapeDiscoveryRoadmap..jspjsp

http://http://setecinvestigationssetecinvestigations.com/resources/.com/resources/legaltoolslegaltools/legaltool6./legaltool6.phpphp

http://www.http://www.impactforensicsimpactforensics.com/checklist.html.com/checklist.html http://www.http://www.metrocorpcounselmetrocorpcounsel.com/current..com/current.phpphp??artTypeartType

=view&=view&artMonthartMonth=July&=July&artYearartYear=2007&=2007&EntryNoEntryNo=6901=6901

Special thanks to Jenny Hedderman, Deputy General Special thanks to Jenny Hedderman, Deputy General Counsel, Office of the Comptroller, Linda Hamel, General Counsel, Office of the Comptroller, Linda Hamel, General Counsel, Information Technology Division, Stephanie Counsel, Information Technology Division, Stephanie Ziertan, Deputy General Counsel, Information Technology Ziertan, Deputy General Counsel, Information Technology Division.Division.